[hellno]

Summary

Adds deckard_send, the 8th mcp.v0.1 tool: a key-less, agent-channel propose path for a native-ETH transfer that flows through the daemon's policy evaluate exactly like deckard_shield. Within the policy's Send rule it auto-allows; over the cap it returns needs_approval; the sidecar only proposes (no self-approve). This makes a within-cap Send carrying real ETH the first value-bearing action the agent can take on its own authority within the Rules, so it also adds an anvil e2e regression that proves the #108 reserve-before-sign + execute-time re-evaluate path has no single-session double-spend — two within-cap auto-allows that together exceed the daily cap cannot both move funds. The palette is verify-only (the human Send action already has its ⌘K command; deckard_send is agent-channel), so deckard-app is untouched.

Linked issue

Part of #135 — PR2 of the policy-v2 keystone (PR1 was #160). Does not close the epic.

Definition of Done

• cargo fmt --all --check is clean
• just check is green — clippy -D warnings on both the default config and --features tray (and deckard-signerd --features dev-signerd-bin)
• cargo test --workspace is green
• No new or changed dependencies in Cargo.toml / Cargo.lock
• Any visual/UI change follows DESIGN.md — N/A: no UI change (deckard-app untouched; the human Send ⌘K command already exists)
• Secrets (seed / key / passphrase) stay in Zeroizing and are never logged or Debug-printed — the deckard-mcp sidecar is key-less and holds no secrets; the new tool's response echoes only decision / request_id / to / amount_eth / next

Evidence (paste command output here)

$ cargo fmt --all --check
# clean, exit 0

$ just check
cargo clippy --locked --workspace --all-targets -- -D warnings
    ... Checking deckard-app v0.0.1-alpha ...
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 18.89s
cargo clippy --locked -p deckard-app --all-targets --features tray -- -D warnings
    Finished `dev` profile target(s)
cargo clippy --locked -p deckard-signerd --all-targets --features dev-signerd-bin -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.77s
# all three passes green, no warnings

$ TMPDIR=/tmp cargo test --workspace
... deckard_mcp (lib)      test result: ok. 11 passed; 0 failed
... acceptance.rs          test result: ok. 16 passed; 0 failed   (T1 eight-tool + 2 new send tests)
... durable_cap_e2e.rs     test result: ok. 2 passed; 0 failed
... send_autoallow_toctou_e2e.rs  test result: ok. 1 passed; 0 failed
... deckard-app (bin)      test result: ok. 59 passed; 0 failed
... (every workspace suite green; 0 failures)

Notes for reviewers

• The real work is the verification, not the tool. The crux is that PR1 lets a within-cap native-ETH Send auto-allow, so the daemon's execute now gates real fund movement. The path was reviewed sound: execute is fully serialized under the single daemon.lock().await.handle() dispatch (server.rs:169), and it re-evaluates an auto-allow against the live post-commit spent_today before reserving (daemon.rs:1312). The new test is guard-pinning — it fails (panics DOUBLE-SPEND) if that re-evaluate is removed.
• A cross-model adversarial review (codex) walked the propose/execute/STOP interleavings and the broadcast-timeout branch and returned ACHIEVED, 0 P0/P1.
• Out of scope (deliberate): an ERC-20 Send reserves 0 against the daily cap (the cap is ETH-wei; token atoms aren't comparable) — deckard_send only ever builds native ETH, so no token path is introduced here. A per-token cap is a separate follow-up.
• Test caveat (macOS): the signerd e2e suites need TMPDIR=/tmp to keep Unix-socket paths under SUN_LEN; the new test runs (not skipped) wherever anvil is on PATH.